Google Pulls AI Agent Workflows After Researchers Expose Prompt-Injection Flaw

Google has deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository after researchers at Pillar Security demonstrated a serious flaw. The issue involved a public-facing 'triage agent' that could be manipulated through a crafted GitHub issue into activating a more privileged 'code-fixing' agent — one designed to make automated changes to code.

The researchers found that by posting a specific comment, an outside party could impersonate a legitimate trigger and cause the privileged bot, identified internally as a trusted collaborator, to act on the request. Because the automated bot's permissions treated this comment as valid, the safeguard meant to keep human oversight in the loop could be bypassed — a technique known as prompt injection, where AI systems are tricked by carefully worded inputs into taking unintended actions.

This case highlights a growing risk as businesses increasingly connect AI agents to development tools, ticketing systems, and code repositories. When AI agents are given the authority to act automatically, attackers may find ways to manipulate their inputs rather than hack the system directly. Google's decision to remove the affected workflows shows how seriously major tech firms are taking these emerging AI security risks.